Access and security

Roles and resources#

nondro defines permission verbs; your organization defines the roles that use them. Built-in templates provide starting points for readers, contributors, operators, stewards, approvers, and access administrators. A template is copied when a role is created, so later template changes do not silently change existing roles.

Permissions apply to matching resources. Role assignments can narrow those resources further and can expire. Open Roles and access to inspect your responsibilities or administer the roles you are authorized to manage.

The permission lens#

The permission lens controls which definitions, object rows, properties, and knowledge a caller may use. Row rules can depend on trusted account attributes. When a required attribute is absent, that rule admits no rows. Sensitive properties are denied unless a matching grant explicitly permits them.

Permissions are evaluated for the current caller. A role name is a useful description, but the effective grants determine the result. Object row restrictions and field permissions should be reviewed together, especially when users hold more than one role.

Delegate to an agent#

A delegated credential combines its owner's current authority with the resources, verbs, scope, and expiry approved for the connection. Later expansion of the owner's role does not automatically expand that ceiling. Revocation, expiry, and loss of current authority can narrow or end access.

Use Advanced permissions & agent access to create a bounded credential, or the instance's configured OAuth flow for a compatible client. Credentials cannot delegate administrative authority or create additional credentials. Grant only what the intended workflow needs.

• read allows permitted retrieval.
• author allows supported drafting or contribution.
• promote is distinct authority for the supported publication operations.
• invoke permits eligible action proposals; shared-agent proposals still require a human decision.

Operate the boundary#

Connecting a source delegates access to a real system. Keep source-side credentials narrowly scoped and review who can author connections. Administrative recovery and deployment configuration remain trusted operator responsibilities.

Audit records support review of changes, approvals, and outcomes. For an access question, use the access explanation tools to inspect the current decision. A resource-level read grant alone does not establish that every row or field is visible.